C:\Users\LWAY\Desktop\lawyS\x64\Release\FreeLway.pdb
Overview
overview
3Static
static
39670B438E96.exe
windows7-x64
19670B438E96.exe
windows10-2004-x64
1Serial Che...er.exe
windows7-x64
1Serial Che...er.exe
windows10-2004-x64
1Serial Che...64.dll
windows7-x64
1Serial Che...64.dll
windows10-2004-x64
1VMProtectSDK64.dll
windows7-x64
1VMProtectSDK64.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
9670B438E96.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9670B438E96.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Serial Checker/Checker.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Serial Checker/Checker.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Serial Checker/VMProtectSDK64.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Serial Checker/VMProtectSDK64.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
VMProtectSDK64.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
VMProtectSDK64.dll
Resource
win10v2004-20240802-en
General
-
Target
Unbranded.rar
-
Size
13.8MB
-
MD5
bfaca3571cef482d77b0a4fb6ab61ed7
-
SHA1
a56617335195dbf3bf1ec5ec6dd486160577fa7c
-
SHA256
cc3a76b189133d4c45ab1d302c1086612bc418b059b07baa8f36dbc207c031da
-
SHA512
5a082ba2dbcbb942ada3c1dbd6a0f865e1bbefeb5416a9fede122bba9239189cfe8fc1d17d135e32dc0ec522580ac4216894626e78adf968d5477632ac0acd87
-
SSDEEP
196608:x0d+soh3b5YAPXHMyi4QRD4Ksy0EIRk8T5GcOYCJL8k40RTksGDDLCeC6xS7MuYA:eboh3b5/f44Q+yC4zhvvTlGe6xStYBq
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/9670B438E96.exe unpack001/Serial Checker/Checker.exe unpack001/Serial Checker/VMProtectSDK64.dll unpack001/VMProtectSDK64.dll
Files
-
Unbranded.rar.rar
-
9670B438E96.exe.exe windows:6 windows x64 arch:x64
9137a50568e6b3227704ac47eee69992
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntdll
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
NtSetInformationThread
VerSetConditionMask
setupapi
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
K32EnumProcessModules
DebugBreak
LocalAlloc
lstrcmpA
CreateFileA
GetCurrentThread
WaitForSingleObject
CreateProcessA
ReadFile
WriteFile
SetFilePointer
Thread32Next
Thread32First
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
OpenThread
GetFileAttributesA
GetSystemInfo
ReadProcessMemory
VirtualQuery
LeaveCriticalSection
FormatMessageA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
GetLocaleInfoEx
FindClose
FindFirstFileW
K32EnumProcesses
GetFileAttributesExW
AreFileApisANSI
MoveFileExW
GetFileInformationByHandleEx
InitOnceComplete
InitOnceBeginInitialize
OutputDebugStringW
QueryFullProcessImageNameW
GetModuleHandleW
SleepEx
GetSystemDirectoryA
GetCurrentThreadId
DeleteCriticalSection
CloseHandle
GetLastError
Sleep
UnmapViewOfFile
CreateFileW
InitializeCriticalSectionEx
GetCurrentProcess
VirtualProtect
GetModuleFileNameA
GlobalUnlock
WideCharToMultiByte
GlobalLock
LocalFree
OpenProcess
GetCurrentProcessId
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
GetProcAddress
GetConsoleWindow
Beep
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetLocaleInfoA
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
K32GetModuleFileNameExW
GetTickCount64
MapViewOfFile
CreateFileMappingW
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
SetLastError
EnterCriticalSection
user32
CreateWindowExA
PeekMessageA
DefWindowProcA
FindWindowExA
PostMessageA
UnregisterClassA
GetWindowLongA
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
FindWindowA
DispatchMessageA
TranslateMessage
GetWindowRect
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
GetForegroundWindow
GetKeyboardLayout
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetMessageExtraInfo
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetLayeredWindowAttributes
UpdateWindow
RegisterClassExA
DestroyWindow
PostQuitMessage
GetSystemMetrics
ShowWindow
GetAsyncKeyState
SetCursorPos
MoveWindow
GetCursorPos
advapi32
CryptEncrypt
CryptReleaseContext
RegOpenKeyExW
RegOpenKeyExA
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
RegGetValueA
RegCloseKey
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
RegQueryValueExA
RegCreateKeyExW
OpenServiceA
QueryServiceStatusEx
OpenProcessToken
CryptAcquireContextA
OpenSCManagerA
LookupPrivilegeValueA
RegQueryValueExW
AdjustTokenPrivileges
CloseServiceHandle
shell32
SHGetFolderPathW
ShellExecuteA
SHGetKnownFolderPath
ole32
CoTaskMemFree
vmprotectsdk64
VMProtectBeginUltra
VMProtectEnd
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Random_device@std@@YAIXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??Bios_base@std@@QEBA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
_Xtime_get_ticks
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
??7ios_base@std@@QEBA_NXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord143
ord217
ord46
ord211
ord50
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord60
crypt32
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CryptDecodeObjectEx
CertAddCertificateContextToStore
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertFindExtension
CertOpenStore
CertGetNameStringW
CertCloseStore
CertEnumCertificatesInStore
CertGetCertificateChain
ws2_32
WSAGetLastError
getpeername
bind
connect
getsockname
gethostname
inet_ntoa
getsockopt
htons
ntohl
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
WSAStartup
gethostbyname
ntohs
__WSAFDIsSet
ioctlsocket
listen
recv
setsockopt
htonl
accept
WSACleanup
WSAIoctl
closesocket
WSASetLastError
socket
send
shlwapi
PathRemoveFileSpecA
StrStrW
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
iphlpapi
GetIfEntry
GetIpForwardTable
winmm
PlaySoundA
mpr
WNetGetProviderNameA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
_CxxThrowException
__current_exception_context
memchr
__current_exception
memmove
__std_terminate
__std_exception_destroy
__std_exception_copy
strstr
wcsstr
memcpy
memset
strchr
strrchr
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fwrite
_wfopen
__stdio_common_vfprintf
fseek
fclose
fflush
fread
__stdio_common_vsscanf
__acrt_iob_func
_lseeki64
_open
_close
_pclose
_write
feof
fputs
fopen
_read
getchar
fgetwc
ungetwc
fputwc
fgets
ftell
fgetws
_wpopen
__stdio_common_vsprintf_s
_popen
__stdio_common_vfwprintf
fputc
__p__commode
fgetc
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_set_fmode
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-string-l1-1-0
strncpy
strncpy_s
_strdup
isupper
tolower
isspace
toupper
strpbrk
strspn
strncmp
strcmp
strcspn
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
realloc
free
calloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_beginthreadex
_errno
abort
strerror
_cexit
exit
_invalid_parameter_noinfo_noreturn
_crt_atexit
_getpid
__sys_nerr
system
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_get_initial_narrow_environment
_configure_narrow_argv
api-ms-win-crt-convert-l1-1-0
strtoul
wcstombs_s
strtol
strtoull
strtoll
atoi
strtod
mbstowcs_s
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_lock_file
remove
_unlock_file
rename
_fstat64
_stat64
_access
_unlink
api-ms-win-crt-math-l1-1-0
sinf
pow
fmodf
sqrtf
_dclass
acosf
ceilf
cosf
__setusermatherr
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 241KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20.5MB - Virtual size: 20.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Serial Checker/Checker.exe.exe windows:6 windows x64 arch:x64
76a5675005b600b907670f0deacacf44
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\LWAY\Desktop\Serial Checker\x64\Release\Perm.pdb
Imports
ntdll
RtlCaptureContext
VerSetConditionMask
RtlLookupFunctionEntry
RtlVirtualUnwind
ncrypt
NCryptGetProperty
NCryptOpenStorageProvider
kernel32
DeleteCriticalSection
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleA
SetConsoleScreenBufferSize
GetStdHandle
TerminateProcess
SetConsoleWindowInfo
K32GetModuleFileNameExW
OpenProcess
K32EnumProcesses
GetConsoleWindow
K32EnumProcessModules
IsDebuggerPresent
GetModuleHandleA
CreateFileA
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetFileSizeEx
FormatMessageA
InitializeCriticalSectionEx
GetModuleHandleW
GetCurrentProcessId
GetProcAddress
CloseHandle
SetLastError
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetEnvironmentVariableA
Sleep
LoadLibraryA
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
QueryPerformanceCounter
GetTickCount
MoveFileExA
InitializeSListHead
OutputDebugStringW
WaitForSingleObjectEx
MultiByteToWideChar
GetLastError
user32
GetWindowLongA
SetWindowLongA
ShowWindow
SetWindowPos
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
vmprotectsdk64
VMProtectEnd
VMProtectBeginUltra
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?good@ios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
shlwapi
StrStrW
normaliz
IdnToAscii
wldap32
ord35
ord79
ord30
ord50
ord32
ord60
ord46
ord217
ord143
ord33
ord45
ord27
ord200
ord211
ord301
ord41
ord22
ord26
crypt32
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CryptEncodeObjectEx
ws2_32
setsockopt
getaddrinfo
freeaddrinfo
recvfrom
sendto
gethostname
ntohl
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
select
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
__current_exception_context
__std_exception_copy
memchr
memcmp
memmove
__C_specific_handler
strrchr
strchr
memset
memcpy
strstr
__std_terminate
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_invalid_parameter_noinfo_noreturn
__sys_nerr
terminate
_getpid
system
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
strerror
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_errno
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
api-ms-win-crt-stdio-l1-1-0
fread
_read
_write
fseek
feof
_close
_open
fgets
_set_fmode
__p__commode
__acrt_iob_func
fputs
fopen
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fwrite
getchar
fputc
ftell
_lseeki64
__stdio_common_vfprintf
fclose
fflush
__stdio_common_vsscanf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
realloc
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strncmp
strncpy
strcmp
strcspn
tolower
strpbrk
_strdup
isupper
strspn
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
_fstat64
_access
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtoll
atoi
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 309KB - Virtual size: 309KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Serial Checker/VMProtectSDK64.dll.dll windows:5 windows x64 arch:x64
1851ff453adce0cef5274e320d5bed3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
Exports
Exports
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
VMProtectSDK64.dll.dll windows:5 windows x64 arch:x64
1851ff453adce0cef5274e320d5bed3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
IsDebuggerPresent
GetLocalTime
GetTickCount
GetModuleFileNameW
GetPrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
HeapFree
HeapAlloc
GetStringTypeW
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleMode
FlushFileBuffers
WriteFile
GetConsoleCP
SetFilePointerEx
CloseHandle
WriteConsoleW
CreateFileW
RaiseException
Exports
Exports
VMProtectActivateLicense
VMProtectBegin
VMProtectBeginMutation
VMProtectBeginUltra
VMProtectBeginUltraLockByKey
VMProtectBeginVirtualization
VMProtectBeginVirtualizationLockByKey
VMProtectDeactivateLicense
VMProtectDecryptStringA
VMProtectDecryptStringW
VMProtectEnd
VMProtectFreeString
VMProtectGetCurrentHWID
VMProtectGetOfflineActivationString
VMProtectGetOfflineDeactivationString
VMProtectGetSerialNumberData
VMProtectGetSerialNumberState
VMProtectIsDebuggerPresent
VMProtectIsProtected
VMProtectIsValidImageCRC
VMProtectIsVirtualMachinePresent
VMProtectSetSerialNumber
Sections
.text Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ